feat: add client-grants organizations list command

docs/auth0_client-grants.md

@@ -12,6 +12,7 @@ Manage client grants. A client grant authorizes an application (client) to reque
 - [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
 - [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
 - [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants organizations](auth0_client-grants_organizations.md) - Manage organizations of a client grant
 - [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
 - [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
 

docs/auth0_client-grants_create.md

@@ -61,6 +61,7 @@ auth0 client-grants create [flags]
 - [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
 - [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
 - [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants organizations](auth0_client-grants_organizations.md) - Manage organizations of a client grant
 - [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
 - [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
 

docs/auth0_client-grants_delete.md

@@ -50,6 +50,7 @@ auth0 client-grants delete [flags]
 - [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
 - [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
 - [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants organizations](auth0_client-grants_organizations.md) - Manage organizations of a client grant
 - [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
 - [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
 

docs/auth0_client-grants_list.md

@@ -57,6 +57,7 @@ auth0 client-grants list [flags]
 - [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
 - [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
 - [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants organizations](auth0_client-grants_organizations.md) - Manage organizations of a client grant
 - [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
 - [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
 

docs/auth0_client-grants_organizations.md

@@ -0,0 +1,13 @@
+---
+layout: default
+has_toc: false
+has_children: true
+---
+# auth0 client-grants organizations
+
+Manage the organizations associated with a client grant.
+
+## Commands
+
+- [auth0 client-grants organizations list](auth0_client-grants_organizations_list.md) - List the organizations of a client grant
+

docs/auth0_client-grants_organizations_list.md

@@ -0,0 +1,48 @@
+---
+layout: default
+parent: auth0 client-grants organizations
+has_toc: false
+---
+# auth0 client-grants organizations list
+
+List the organizations associated with a client grant.
+
+## Usage
+```
+auth0 client-grants organizations list [flags]
+```
+
+## Examples
+
+```
+  auth0 client-grants organizations list
+  auth0 client-grants organizations ls <client-grant-id>
+  auth0 client-grants organizations list <client-grant-id> --number 100
+  auth0 client-grants organizations ls <client-grant-id> -n 100 --json
+```
+
+
+## Flags
+
+```
+      --json           Output in json format.
+      --json-compact   Output in compact json format.
+  -n, --number int     Number of organizations to retrieve. Minimum 1, maximum 1000. (default 100)
+```
+
+
+## Inherited Flags
+
+```
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 client-grants organizations list](auth0_client-grants_organizations_list.md) - List the organizations of a client grant
+
+

docs/auth0_client-grants_show.md

@@ -45,6 +45,7 @@ auth0 client-grants show [flags]
 - [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
 - [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
 - [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants organizations](auth0_client-grants_organizations.md) - Manage organizations of a client grant
 - [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
 - [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
 

docs/auth0_client-grants_update.md

@@ -57,6 +57,7 @@ auth0 client-grants update [flags]
 - [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
 - [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
 - [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants organizations](auth0_client-grants_organizations.md) - Manage organizations of a client grant
 - [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
 - [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
 

internal/auth/auth.go

@@ -140,7 +140,7 @@ var RequiredScopes = []string{
 	"read:anomaly_blocks", "delete:anomaly_blocks",
 	"create:log_streams", "delete:log_streams", "read:log_streams", "update:log_streams",
 	"create:actions", "delete:actions", "read:actions", "update:actions",
-	"create:organizations", "delete:organizations", "read:organizations", "update:organizations", "read:organization_members", "read:organization_member_roles", "read:organization_connections",
+	"create:organizations", "delete:organizations", "read:organizations", "update:organizations", "read:organization_members", "read:organization_member_roles", "read:organization_connections", "read:organization_client_grants",
 	"read:prompts", "update:prompts",
 	"read:attack_protection", "update:attack_protection",
 	"read:event_streams", "create:event_streams", "update:event_streams", "delete:event_streams", "read:events",

internal/auth/scopes_test.go

@@ -38,7 +38,7 @@ func TestRequiredScopes(t *testing.T) {
 			"read:custom_domains", "create:custom_domains", "update:custom_domains", "delete:custom_domains",
 			"read:client_keys", "read:logs", "read:tenant_settings",
 			"read:anomaly_blocks", "delete:anomaly_blocks",
-			"read:organization_members", "read:organization_member_roles",
+			"read:organization_members", "read:organization_member_roles", "read:organization_client_grants",
 			"read:prompts", "update:prompts",
 			"read:attack_protection", "update:attack_protection",
 		}

internal/auth0/auth0.go

@@ -78,6 +78,7 @@ func NewAPI(m *management.Management) *API {
 type APIV3 struct {
 	AttackProtectionBotDetection AttackProtectionBotDetectionAPIV3
 	ClientGrant                  ClientGrantAPIV3
+	ClientGrantOrganization      ClientGrantOrganizationAPIV3
 	Events                       EventsAPIV3
 	PhoneNotificationTemplate    PhoneNotificationTemplateAPI
 }
@@ -86,6 +87,7 @@ func NewAPIV3(m *managementv3.Management) *APIV3 {
 	return &APIV3{
 		AttackProtectionBotDetection: m.AttackProtection.BotDetection,
 		ClientGrant:                  m.ClientGrants,
+		ClientGrantOrganization:      m.ClientGrants.Organizations,
 		Events:                       m.Events,
 		PhoneNotificationTemplate:    m.Branding.Phone.Templates,
 	}

internal/auth0/client_grant.go

@@ -73,3 +73,25 @@ type ClientGrantAPIV3 interface {
 		opts ...option.RequestOption,
 	) error
 }
+
+// ClientGrantOrganizationPage is the paginated response returned by the
+// client-grant organizations endpoint. It is aliased here so the mock generator
+// (which cannot parse instantiated generic types) sees a plain named type in the
+// interface.
+type ClientGrantOrganizationPage = core.Page[*string, *managementv3.Organization, *managementv3.ListClientGrantOrganizationsPaginatedResponseContent]
+
+// ClientGrantOrganizationAPIV3 is the interface for the
+// /client-grants/{id}/organizations endpoint.
+type ClientGrantOrganizationAPIV3 interface {
+	// List the organizations associated with a client grant.
+	//
+	// Required scope: `read:organization_client_grants`
+	//
+	// See: https://auth0.com/docs/api/management/v2/client-grants/get-client-grant-organizations
+	List(
+		ctx context.Context,
+		id string,
+		request *managementv3.ListClientGrantOrganizationsRequestParameters,
+		opts ...option.RequestOption,
+	) (*ClientGrantOrganizationPage, error)
+}

internal/cli/client_grants.go

@@ -129,6 +129,7 @@ func clientGrantsCmd(cli *cli) *cobra.Command {
 	cmd.AddCommand(showClientGrantCmd(cli))
 	cmd.AddCommand(updateClientGrantCmd(cli))
 	cmd.AddCommand(deleteClientGrantCmd(cli))
+	cmd.AddCommand(organizationsClientGrantCmd(cli))
 
 	return cmd
 }
@@ -667,10 +668,13 @@ func (c *cli) mutableClientGrantPickerOptions(ctx context.Context) (pickerOption
 }
 
 func (c *cli) clientGrantPickerOptionsFiltered(ctx context.Context, excludeSystem bool) (pickerOptions, error) {
-	// Fetch only the first page, matching the apis/apps pickers. This keeps the
-	// picker fast to open on large tenants; if a grant is not on the first page,
-	// the user can pass its id directly.
-	page, err := c.apiv3.ClientGrant.List(ctx, &managementv3.ListClientGrantsRequestParameters{})
+	// Fetch a single page of up to 100 grants. The API defaults to 50 per page,
+	// which silently drops grants past that on busy tenants; taking 100 keeps the
+	// common case selectable while still opening fast. If a grant is not on this
+	// page, the user can pass its id directly.
+	page, err := c.apiv3.ClientGrant.List(ctx, &managementv3.ListClientGrantsRequestParameters{
+		Take: auth0.Int(100),
+	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to list client grants: %w", err)
 	}
@@ -686,7 +690,7 @@ func (c *cli) clientGrantPickerOptionsFiltered(ctx context.Context, excludeSyste
 			identifier = string(grant.GetDefaultFor())
 		}
 
-		label := fmt.Sprintf("%s %s", identifier, ansi.Faint("("+grant.GetAudience()+")"))
+		label := fmt.Sprintf("%s %s %s", ansi.Faint(grant.GetID()), identifier, ansi.Faint("("+grant.GetAudience()+")"))
 		opts = append(opts, pickerOption{value: grant.GetID(), label: label})
 	}
 

internal/cli/client_grants_organizations.go

@@ -0,0 +1,87 @@
+package cli
+
+import (
+	"fmt"
+
+	managementv3 "github.com/auth0/go-auth0/v3/management"
+	"github.com/spf13/cobra"
+
+	"github.com/auth0/auth0-cli/internal/ansi"
+)
+
+func organizationsClientGrantCmd(cli *cli) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "organizations",
+		Short: "Manage organizations of a client grant",
+		Long:  "Manage the organizations associated with a client grant.",
+	}
+
+	cmd.SetUsageTemplate(resourceUsageTemplate())
+	cmd.AddCommand(listOrganizationsClientGrantCmd(cli))
+
+	return cmd
+}
+
+func listOrganizationsClientGrantCmd(cli *cli) *cobra.Command {
+	var inputs struct {
+		ID     string
+		Number int
+	}
+
+	cmd := &cobra.Command{
+		Use:     "list",
+		Aliases: []string{"ls"},
+		Args:    cobra.MaximumNArgs(1),
+		Short:   "List the organizations of a client grant",
+		Long:    "List the organizations associated with a client grant.",
+		Example: `  auth0 client-grants organizations list
+  auth0 client-grants organizations ls <client-grant-id>
+  auth0 client-grants organizations list <client-grant-id> --number 100
+  auth0 client-grants organizations ls <client-grant-id> -n 100 --json`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if inputs.Number < 1 || inputs.Number > 1000 {
+				return fmt.Errorf("number flag invalid, please pass a number between 1 and 1000")
+			}
+
+			if len(args) == 0 {
+				if err := clientGrantID.Pick(cmd, &inputs.ID, cli.clientGrantPickerOptions); err != nil {
+					return err
+				}
+			} else {
+				inputs.ID = args[0]
+			}
+
+			var organizations []*managementv3.Organization
+			if err := ansi.Waiting(func() error {
+				page, err := cli.apiv3.ClientGrantOrganization.List(cmd.Context(), inputs.ID, &managementv3.ListClientGrantOrganizationsRequestParameters{})
+				if err != nil {
+					return err
+				}
+
+				iter := page.Iterator()
+				for iter.Next(cmd.Context()) {
+					organizations = append(organizations, iter.Current())
+					if len(organizations) >= inputs.Number {
+						break
+					}
+				}
+				return iter.Err()
+			}); err != nil {
+				return fmt.Errorf("failed to list organizations for client grant with ID %q: %w", inputs.ID, err)
+			}
+
+			cli.renderer.ClientGrantOrganizationList(organizations)
+
+			return nil
+		},
+	}
+
+	clientGrantNumber.Help = "Number of organizations to retrieve. Minimum 1, maximum 1000."
+	clientGrantNumber.RegisterInt(cmd, &inputs.Number, defaultPageSize)
+
+	cmd.Flags().BoolVar(&cli.json, "json", false, "Output in json format.")
+	cmd.Flags().BoolVar(&cli.jsonCompact, "json-compact", false, "Output in compact json format.")
+	cmd.MarkFlagsMutuallyExclusive("json", "json-compact")
+
+	return cmd
+}